Although instrumentation, computers, and other hardware can be periodically pulled out of service for routine testing, or tested in place by connection to special test equipment, it is often preferable to provide a built-in, self-test capability within integrated circuits comprising such devices. Any problems that arise in the proper operation of the circuits are then identified much sooner than might occur as the result of a periodically scheduled test. In certain critical applications of integrated circuits, especially those involving human safety, improper operation of a circuit for even a brief time may be intolerable. For example, failure of integrated circuits used in aviation systems may pose a significant risk to the lives of all the passengers on an aircraft. Early detection of a problem in such a system as a result of a built-in, self-test capability can alert the crew of an aircraft about a failed component, so that corrective action can be taken.
Typically, a built-in, self-test capability in integrated circuits and other hardware devices is initiated each time that the device is first energized. For example, personal computers often initiate a random access memory test each time the computer is turned on or reset. Alternatively, self tests can be run on demand, either when a monitoring circuit detects an indication of a fault in a device or at periodic, timed intervals.
A possible fault condition is also readily detected in fault tolerant systems that use redundant components. For example, a typical fault tolerant system may include three identical signal processing circuits running in parallel and a "voter" to compare the signals from the three circuits in order to select one of the signals as an output. If the signal output from one of the redundant circuits differs from the signal output from the other two, the voter detects a fault condition, and would then normally use the signal from the two circuits that are in agreement as the system output signal. However, the two circuits producing the same output signal may both be faulty. To determine which circuit(s) are faulty, the voter can initiate a self test of all three circuits.
In the preceding example, a fault is detected during the normal operation of the fault tolerant system while the redundant circuits are perhaps processing a limited range of input signals, i.e., a subset of the full range of signals that could be input. It is entirely possible that a fault not detectable with the limited range or type of input signals currently being processed may exist in one of the circuits, lying latent and unrecognized for some time. Clearly, it is preferable to find all faults in a circuit before any fault becomes a problem. There is thus an inherent limitation in a system that performs a self test (on demand) only after a fault is detected, particularly where the fault is tentatively detected using the normal limited range or type of input signals rather than a full range of test signals.
Regardless of whether it is initiated at start up of a circuit, at periodic intervals, or on demand after a fault is tentatively detected, a conventional self test that uses a test signal input usually interrupts the normal operation and function of the circuit under test. This interruption continues until the self test is completed. While a circuit is undergoing a self test, it is unavailable to perform tasks that other parts of the system in which it is installed may require to function normally. For conventional, periodically initiated self tests of a circuit, the frequency with which the self tests are initiated thus represents a tradeoff between the efficiency and reliability of the circuit.
One way to avoid interrupting the normal operation of a circuit for a self test is to implement a random hit test. In this technique, a normal input signal is compared to a pseudorandom test signal that is generated in the background. If a match is achieved, the random "hit" causes the output signal of the circuit to be digitally compacted. The digitally compacted signal is then compared to the expected "signature" of the pseudorandom signal. Any discrepancies indicate a fault in the circuit. Attempts to quantify the reliability of such a system have shown that this scheme requires relatively long time intervals to develop complete and meaningful test results.
In signature check pointing tests, intermediate signatures of a circuit output signal are compared against expected values. To determine if the circuit is operating properly, the particular system operation leading to the test signature must be known and never change. For example, the correct functional operation of a processor can be evaluated or verified from the signature developed as a result of the processor carrying out certain operations. However, this technique has limited utility because the sequence of input and the operation of the circuit under test must be known and remain unaltered if the same signatures are to be produced every time by a properly functioning circuit.
In consideration of the above-noted problems with conventional self-test methods, it is an object of the present invention to carry out a self test of a circuit without interrupting its normal functional operation. Furthermore, it is an object to self test a circuit during a portion of each system clock cycle in which the circuit is not required to implement its normal functions. Yet a further object is to carry out the self test in increments, completing parts of the self test at times that the circuit is not required to carry out its normal function, and determining a signature for the result only after the self test is completed. Still a further object is to increase the reliability and fault isolation capability of fault tolerant voting systems. These and other objects and advantages of the present invention will be apparent from the attached drawings and the Description of the Preferred Embodiments that follows.